© 2023 Check Point Software Technologies Ltd. All rights reserved. | August 30, 2023 1

Quantum 7000 Hyperscale Security Gateway for Maestro

Scalable, resilient AI Deep Learning powered threat prevention The Maestro hyperscale network security solution orchestrates multiple Quantum firewalls as one unified system, with seamless and near limitless scaling. Bring scale, agility and elasticity of the cloud on premises with efficient N+1 clustering based on Check Point HyperSync technology. Maestro Hyperscale Orchestrators distribute internal and external network traffic equally across multiple 7000 firewalls managed as a single group with a common security feature set and policy. With Maestro, businesses of all sizes can have cloud scale and agility with datacenter resiliency — all while maximizing cost efficiency. PERFORMANCE HIGHLIGHTS

Firewall Next Gen Firewall Threat Prevention 48 Gbps 22 Gbps 9.5 Gbps

Top Security Effectiveness Leader with 99.7% malware block rate in Miercom NGFW Security Benchmark (2023) AI ML powered Threat Prevention Protect networks and users from zero-days, phishing, DNS, and ransomware attacks Hyperscale Network Security On-demand expansion and resilient access to mission-critical applications Unified Management and Ops Efficiency Increase protection and reduce TCO with a consolidated security architecture Industry Recognition Named a Leader for the 23rd time in the Gartner® Magic Quadrant™ for Network Firewalls Named a Leader in the Forrester Wave™ Enterprise Firewalls Q4 2022 Awarded the Frost & Sullivan Firewall Company of the Year

© 2023 Check Point Software Technologies Ltd. All rights reserved. | August 30, 2023 2

HIGH PERFORMANCE, SCALABLE SECURITY

Hyperscale Security System With Maestro, you can start with two gateways and then can grow to up to 52 gateways. For example, when you start with 19 Gbps using two 7000HS gateways you can finish with a 475 Gbps security solution. Simply by using Check Point Maestro.

Hyperscale Orchestrator Connections When a Security Group is created, an IP address is created for a Single Management Object connection to the security management server. Easily create and assign IP addresses to the internal and external network interfaces. These uplinks are the visible components of the Maestro security solution.

Fully Operational within Minutes

When we add a gateway to the system, it gets all the configurations, the policy, even the software version, updated and aligned with the existing deployment, ready to go within 6 minutes.

Maestro Traffic Distribution HyperSync tracks the Active/Standby/Backup state of group members. Sync traffic is limited to only the Active and Standby members handling the connection.

Cost-Efficient N+1 Deployments Now businesses of all sizes can enjoy cloud-level resiliency and telco-grade technology using the efficient Maestro N+1 clustering design.

1. Sync 10/100/1000 Base-T port 6. 2x USB 3.0 ports 2. RJ45 console port 7. Lights-out Management port 3. 2x network card expansion slots 8. USB Type-C console port 4. 8x 10/100/1000 Base-T ports 9. 2x 480GB SSD RAID1 5. Management 10/100/1000 Base-T port 10. Redundant hot-swap power supplies

10

4

1 2

6 7

8

5

3

7000 SECURITY GATEWAY

9

© 2023 Check Point Software Technologies Ltd. All rights reserved. | August 30, 2023 3

SPECIFICATIONS Performance

Enterprise Test Conditions

Threat Prevention (Gbps)1 NGFW (Gbps)2 IPS (Gbps) Firewall (Gbps)

9.5 22 25 48

RFC 3511, 2544, 2647, 1242 Performance (Lab)

Firewall 1518B UDP (Gbps) VPN AES-128 (Gbps) Connections/sec Concurrent connections

76.8 11.9

330,000 4/8/16M

1. Includes Firewall, Application Control, URL Filtering, IPS, Antivirus, Anti-Bot and SandBlast Zero-Day Protection

with logging enabled. 2. Includes Firewall, Application Control and IPS with logging enabled. Additional Features

Highlights

• 4x 10 GbE SFP+ ports

• 1x CPUs, 16 physical cores, 32 virtual cores

• 2x 480 GB SSDs

• 2x AC power supplies

• 32 GB memory

• Virtual Systems (Plus/max mem): 30/50 Content Security

First Time Prevention Capabilities

• CPU-level, OS-level and static file analysis

• File disarm and reconstruction via Threat Extraction

• Average emulation time for unknown files that require full sandbox evaluation is under 100 seconds

• Maximal file size for Emulation is 100 MB

• Emulation OS Support: Windows XP, 7, 8.1, 10

Applications

• Use 10,000+ pre-defined or customize your own applications

• Accept, prevent, schedule, and apply traffic-shaping

Data Loss Prevention

• Classify 700+ pre-defined data types

• End user and data owner incident handling

Dynamic User-based Policy

• Integrates with Microsoft AD, LDAP, RADIUS, Cisco pxGrid, Terminal Servers and with 3rd parties via a Web API

• Enforce consistent policy for local and remote users on Windows, macOS, Linux, Android and Apple iOS platforms

Network Network Connectivity

• Total physical and virtual (VLAN) interfaces per appliance: 1024/4096 (single gateway/with virtual systems)

• 802.3ad passive and active link aggregation

• Layer 2 (transparent) and Layer 3 (routing) mode

High Availability

• Active/Active L2, Active/Passive L2 and L3 • Session failover for routing change, device and link failure

IPv6

• NAT66

• CoreXL, SecureXL

Unicast and Multicast Routing (see SK98226)

• OSPFv2, BGP, RIP

• Static routes, Multicast routes

• Policy-based routing

• PIM-SM, PIM-DM, IGMP v2, and v3 Maestro

Maximums

• Up to 8 Security Groups

• Up to 31 gateways in a Security Group

• Up to 28 gateways in a Security Group (dual site deployment, 14 from each site)

• 48x 10 GbE and 8x 100 GbE ports (MHO 140) Physical

Power Requirements

• Single Power Supply rating: 500W • AC power input: 100 to 240V (47-63Hz) • Power consumption avg/max: 144W/190W • Maximum thermal output: 648.3 BTU/hr.

Dimensions

• Enclosure: 1RU

• Dimensions (WxDxH): 17.2 x 22.83 x 1.73 in. (438 x 580 x 44mm)

• Weight: 19.8 lbs. (9 kg)

Environmental Conditions

• Operating: 0° to 40°C, humidity 5% to 95%

• Storage: –20° to 70°C, humidity 5% to 95% at 60°C

Certifications

• Safety: UL, CB, CE, TUV GS

• Emissions: FCC, CE, VCCI, RCM/C-Tick

• Environmental: RoHS, WEEE, REACH1, ISO140011 1 factory certificate

© 2023 Check Point Software Technologies Ltd. All rights reserved. | August 30, 2023 4

ORDERING QUANTUM 7000HS MAESTRO SOLUTIONS

MAESTRO HYPERSCALE SOLUTION PACKAGES SKU Maestro Solution with two 7000 firewalls with SandBlast subscription package for 1 year and one Orchestrator (MHO-140). Each appliance includes 32 GB RAM, 10x 1GbE copper on-board, 4x 10GbE fiber, 2x AC PSU, 2x 480GB SSD, LOM, telescopic rails, plus 2x 10G DAC cables (3m, 3m). MHO-140 includes 1x 10G DAC (3m).

CPAP-MHS-7002-PLUS-SNBT

Maestro Solution with three 7000 firewalls with SandBlast subscription package for 1 year and one Orchestrator (MHO-140). Each appliance includes 32 GB RAM, 10x 1GbE copper on-board, 4x 10GbE fiber, 2x AC PSU, 2x 480GB SSD, LOM, telescopic rails, plus 2x 10G DAC cables (3m, 3m). MHO-140 includes 1x 10G DAC (3m).

CPAP-MHS-7003-PLUS-SNBT

SECURITY GATEWAY APPLIANCES FOR SCALE-UP SKU 7000 security gateway for Maestro including 32 GB RAM, 10x 1GbE copper on-board, 4x 10GbE fiber, 2x AC PSU, 2x 480GB SSD, LOM, plus 2x 10G DAC cables (3m, 3m) with SandBlast subscription package for 1 year.

CPAP-SG7000-PLUS-MHS-SNBT

SECURITY GATEWAY ACCESSORIES SKU

Direct Attach Copper (DAC) cables 10GbE SFP+ to SFP+, 3M CPAC-DAC-10G-3M

Memory upgrade kit from 32GB to 64GB for 7000 appliances CPAC-RAM32GB-7000

Replacement AC power supply for 7000 Security Gateways CPAC-PSU-AC-7000

Lights-Out Management Module CPAC-NLOM-C

Extended slide rails for 7000 Security Gateways (24” - 36”) CPAC-RAILS-EXT-6000/7000

MAESTRO HYPERSCALE ORCHESTRATOR SKU Maestro Hyperscale Orchestrator 140 with 8x 100 GbE and 48x 10 GbE ports, plus 1x 10G DAC (3m). CPAP-MHO-140

MAESTRO HYPERSCALE ORCHESTRATOR ACCESSORIES SKU Fan replacement for Maestro Hyperscale Orchestrator 140 CPAC-FAN-MHO140

AC power supply unit replacement for Maestro Hyperscale Orchestrator 140 and 170 CPAC-PSU-AC-MHO140/170

Rail kit for Maestro Hyperscale Orchestrators 140 and 170 CPAC-RAIL-MHO140/170

MHO-140 TRANSCEIVERS SKU 100G CWDM4, LC connector, 2Km/ single mode fiber CPAC-TR-100CWDM4

100G SWDM4, LC connector, 75m/OM3 fiber CPAC-TR-100SWDM4

QSFP28 transceiver module for 100G fiber ports - short range (100GBase-SR4) CPAC-TR-100SR

QSFP28 transceiver module for 100G fiber ports - long range (100GBase-LR4) CPAC-TR-100LR

QSFP+ transceiver for 40G fiber Ports - short range (40GBase-SR) OM3 fiber 100m, OM4 fiber 150m CPAC-TR-40SR-QSFP-100m

QSFP+ transceiver module for 40G fiber ports - short range (40GBase-SR) CPAC-TR-40SR-QSFP-300m

QSFP+ transceiver module for 40G fiber ports - long range (40GBase-LR) CPAC-TR-40LR-QSFP-10Km

Bi-directional QSFP transceiver for 40G fiber Ports - short range (40GBase-SR-BD) CPAC-TR-40SR-QSFP-BIDI

QSFP+ splitter for 40G fiber ports for Maestro (MHO140 and MHO170) – 3 meters CPAC-TR-40SPLIT-QSFP-3M **

QSFP+ splitter for 40G fiber ports for Maestro (MHO140 and MHO170) – 6 meters CPAC-TR-40SPLIT-QSFP-6M **

SFP28 transceiver module for 100G fiber ports - short range (25GBase-SR SFP28) CPAC-TR-25SR-C

SFP28 transceiver module for 100G fiber ports - long range (25GBase-LR SFP28) CPAC-TR-25LR-C

SFP+ transceiver module for 10G fiber ports - for links up to 40km (10GBASE-ER) CPAC-TR-10ER-C

SFP+ transceiver module for 10G fiber ports - long range up to 10km (10GBase-LR) CPAC-TR-10LR-C

SFP+ transceiver module for 10G fiber ports - short range (10GBase-SR) CPAC-TR-10SR-C

SFP+ transceiver 10GBASE-T RJ45 (Copper) - for links up to 30m over CAT6a/CAT7 CPAC-TR-10T-C

SFP transceiver module for 1G fiber ports - short range (1000Base-SX) CPAC-TR-1SX-C

SFP transceiver module for 1G fiber ports - long range (1000Base-LX) CPAC-TR-1LX-C

SFP transceiver to 1000 Base-T RJ45 (Copper) CPAC-TR-1T-C * In the R81.20 software release and later, the MHO-140 1/10G interfaces support 25G transceivers, ** It is recommended to use the CPAC-TR-40SR-QSFP-100m when using the splitters CPAC-TR-40SPLIT-QSFP-3M or CPAC-TR-40SPLIT-QSFP-6M

© 2023 Check Point Software Technologies Ltd. All rights reserved. | August 30, 2023 5

ORDERING MAESTRO SOLUTIONS (Continued) All-inclusive Security

NGFW NGTP SNBT

(SandBlast)

Basic access control with IPS

Prevent known threats Prevent known and zero- day attacks

Firewall    VPN (IPsec)    Mobile Access    Identity Awareness    Application Control    Content Awareness    IPS    URL Filtering   Anti-Bot   Anti-Virus   Anti-Spam   DNS Security   SandBlast Threat Emulation  SandBlast Threat Extraction  Zero Phishing 

Each gateway requires a license for the enabled security feature. The first-year purchase includes the SNBT package. Security subscription renewals, NGFW, NGTP

and SNBT are available for subsequent years.

CONTACT US North America - +1-866-488-6691 | International - +44-125-333-5558 | www.checkpoint.com